test(anthropic-subscription): use a plainly fake OAuth token in the real-CLI capture tests

Merged
CO
9d ago
+3-3

Fixes #3436.

GitGuardian flagged a "Generic High Entropy Secret" on #3296 after it merged main. The finding pointed at the CLAUDE_CODE_OAUTH_TOKEN fixture in the #3408 regression test (sk-ant-oat01-…). That token only goes to a local 127.0.0.1 mock server, and no test asserts on its value.

Change (tests only, 2 files, 3 lines): the #3408 and #2982 real-CLI capture tests now pass fake-oauth-token-for-local-mock-server. It has no real-token prefix and nothing random-looking, so scanners have nothing to match. I swept the other subscription tests: the remaining sk-ant-oat01-test… values in packages/ai and interactive-mode-anthropic-warning are short literal "test" strings that were never flagged, so they're left as is.

Evidence (mengmotaMac, fresh clone at the head, pinned bun 1.4.2):

  • bun install --frozen-lockfile: exit 0
  • bun run check: exit 0
  • 3408-subscription-requested-window + 2982-anthropic-subscription-append-only-prompt-capture: 2 files, 9/9 passed, none skipped. Both spawn the installed Claude Code CLI against the mock, so this proves the CLI accepts a token without the sk-ant-oat01- prefix.
  • changelog gate: PASS (tests only).

Summary by cubic

Replaces the sk-ant-oat01--shaped CLAUDE_CODE_OAUTH_TOKEN fixtures in the #3408 and #2982 real-CLI capture tests with fake-oauth-token-for-local-mock-server, so GitGuardian no longer flags them as high-entropy secrets. The token only reaches a local 127.0.0.1 mock server and no test asserts on its value. Tests only, no product behavior changes.